@bongos/core 1.25.13 → 1.25.14

package/modules/hall-ui/public/work.js

@@ -641,54 +641,10 @@
   async function copyPromptForTask(taskId, btn) {
     const t = taskState.all.find((x) => String(x.id) === String(taskId));
     if (!t) return;
-    const prompt = buildPromptForTask(t);
-    const icon = btn.querySelector('.task__copy-icon');
-    const label = btn.querySelector('.task__copy-label');
-    try {
-      await navigator.clipboard.writeText(prompt);
-      btn.dataset.copied = '1';
-      if (icon) icon.textContent = '✓';
-      if (label) label.textContent = 'Copied';
-      setTimeout(() => {
-        btn.dataset.copied = '0';
-        if (icon) icon.textContent = '📋';
-        if (label) label.textContent = 'Copy prompt';
-      }, 1600);
-      toast(`Prompt for #${taskId} copied to your clipboard.`);
-    } catch (err) {
-      try {
-        const ta = document.createElement('textarea');
-        ta.value = prompt;
-        ta.style.position = 'fixed';
-        ta.style.opacity = '0';
-        document.body.appendChild(ta);
-        ta.select();
-        document.execCommand('copy');
-        ta.remove();
-        toast(`Prompt for #${taskId} copied.`);
-      } catch (_) {
-        toast('Could not copy to the clipboard. Try again.');
-      }
-    }
-  }
-  async function copyText(text) {
-    try { await navigator.clipboard.writeText(text); return true; }
-    catch (_) {
-      try {
-        const ta = document.createElement('textarea');
-        ta.value = text;
-        ta.style.position = 'fixed';
-        ta.style.opacity = '0';
-        document.body.appendChild(ta);
-        ta.select();
-        const ok = document.execCommand('copy');
-        ta.remove();
-        return ok;
-      } catch (_e) {
-        return false;
-      }
-    }
+    await window.OTBTaskLib.copyTaskPrompt(t, btn, toast);
   }
+  // The hall's one clipboard write (task-lib.js), kept under this name for the ctx below.
+  const copyText = (text) => window.OTBTaskLib.copyText(text);
 
   // ---- bulk selection (task 1759) -------------------------------------------
 

package/modules/lifecycle/kickoff-seed.js

@@ -112,20 +112,24 @@ async function seedGenesisStages({ builderId = null, existing = false } = {}, de
   return { seeded, versionId };
 }
 
-// genesisStageTasks(deps) → { stageKey: [{ id, title, status }] } for every genesis
-// task on the board, grouped by the stage its source_ref names. The genesis home lists
-// them, and a stage close hands their ids to the Board Room's finished-tasks gate.
+// genesisStageTasks(deps) → { stageKey: [{ id, title, status, description }] } for every
+// genesis task on the board, grouped by the stage its source_ref names. The genesis home
+// lists them, and a stage close hands their ids to the Board Room's finished-tasks gate.
+// The description rides along so each row's Copy prompt carries the task's own words
+// (task 1005109); the read stays bounded, it is only the few seeded genesis tasks.
 async function genesisStageTasks(deps = {}) {
   const pool = deps.pool || api.pool;
   const { rows } = await pool.query(
-    `SELECT id, title, status, source_ref FROM tasks WHERE source = $1 ORDER BY id ASC`,
+    `SELECT id, title, status, description, source_ref FROM tasks WHERE source = $1 ORDER BY id ASC`,
     [GENESIS_SOURCE],
   );
   const out = {};
   for (const r of rows) {
     const stage = String(r.source_ref || '').split(':')[1];
     if (!stage) continue;
-    (out[stage] = out[stage] || []).push({ id: String(r.id), title: r.title, status: r.status });
+    (out[stage] = out[stage] || []).push({
+      id: String(r.id), title: r.title, status: r.status, description: r.description || '',
+    });
   }
   return out;
 }

package/modules/onboarding/genesis-home.js

@@ -146,7 +146,7 @@ const FINISHED = Object.freeze(['shipped', 'abandoned']); // the Board Room's ow
 // shapeGenesis({ mode, plan, tasks, board, stageAt }) — PURE. The genesis home's view.
 //   mode    foundingModeFor's shape (non-null)
 //   plan    the saved plan or null (deciding)
-//   tasks   { stage: [{ id, title, status }] }
+//   tasks   { stage: [{ id, title, status, description }] }
 //   board   { stage: genesisStageStatus row } or {}
 //   stageAt { stage: ISO } — when each stage began, for its due date
 function shapeGenesis({ mode, plan, tasks = {}, board = {}, stageAt = {} }) {

package/package-lock.json

@@ -1,16 +1,232 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.13",
+  "version": "1.25.14",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.13",
+      "version": "1.25.14",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",
-        "pg": "^8.20.0"
+        "pg": "^8.20.0",
+        "pino": "^9.14.0",
+        "@simplewebauthn/browser": "^13.3.0",
+        "@simplewebauthn/server": "^13.3.3"
+      }
+    },
+    "node_modules/@hexagon/base64": {
+      "version": "1.1.28",
+      "resolved": "https://registry.npmjs.org/@hexagon/base64/-/base64-1.1.28.tgz",
+      "integrity": "sha512-lhqDEAvWixy3bZ+UOYbPwUbBkwBq5C1LAJ/xPC8Oi+lL54oyakv/npbA0aU2hgCsx/1NUd4IBvV03+aUBWxerw==",
+      "license": "MIT"
+    },
+    "node_modules/@levischuck/tiny-cbor": {
+      "version": "0.2.11",
+      "resolved": "https://registry.npmjs.org/@levischuck/tiny-cbor/-/tiny-cbor-0.2.11.tgz",
+      "integrity": "sha512-llBRm4dT4Z89aRsm6u2oEZ8tfwL/2l6BwpZ7JcyieouniDECM5AqNgr/y08zalEIvW3RSK4upYyybDcmjXqAow==",
+      "license": "MIT"
+    },
+    "node_modules/@peculiar/asn1-android": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-android/-/asn1-android-2.11.0.tgz",
+      "integrity": "sha512-llW/qjavL+tOxt5i9whUv4wsbsLpUwI6k/DrvKsdA/H7A/TB/6CosMFgvei28fcJ8ncD0c5lig1oBBlo4KGMCw==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-cms": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-cms/-/asn1-cms-2.11.0.tgz",
+      "integrity": "sha512-SlAiDoT/Cd8qaNmbTt78gqyaEvu2fQd6ML6KWJkdjXGrgDKnHHrusVkfQUelkfinL2p665IIADb0JBixtT8W1g==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "@peculiar/asn1-x509-attr": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-csr": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-csr/-/asn1-csr-2.11.0.tgz",
+      "integrity": "sha512-M/ED0yJ05qMK+UADPKnIa8vhAeewOJALSxTAZB7RQ/batRHhIJZkwznCcWAbFO5saHJ1yEQ+m4lncEcG9RnQSg==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-ecc": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-ecc/-/asn1-ecc-2.11.0.tgz",
+      "integrity": "sha512-jj1alGEKev7/un+cI+exyVK9m31lmP7cCBMCZuCb0wkFQH2zmKmJzNiG4wqXFNzlcP8timHLnzf3lV3OxBpb/Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-pfx": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pfx/-/asn1-pfx-2.11.0.tgz",
+      "integrity": "sha512-ykSAWRu8KkmzU8LRpk9ZQC3zuLmBEtoSMjIv9XHVamD5W7amqreV5wttKqnvtjWOzzSJQxA/HVT8/tHwpEEGSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-cms": "^2.11.0",
+        "@peculiar/asn1-pkcs8": "^2.11.0",
+        "@peculiar/asn1-rsa": "^2.11.0",
+        "@peculiar/asn1-schema": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-pkcs8": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs8/-/asn1-pkcs8-2.11.0.tgz",
+      "integrity": "sha512-lragjkjQGnQ5luxC+sxoAfAO/jBiQ7hOEGlDKJUk7MC5zY3AzjB2DU0GyPUH1Sswdv10t7DurY0zylOYMLb88w==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-pkcs9": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs9/-/asn1-pkcs9-2.11.0.tgz",
+      "integrity": "sha512-gDdFjpqV0weJjgNUvueUVf4D8uVbpq+VbG0TsxLAY2QGljAkJyL9qwQ7avol9j0jaYSJ7Ey7v7RZp0M3GTcQSA==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-cms": "^2.11.0",
+        "@peculiar/asn1-pfx": "^2.11.0",
+        "@peculiar/asn1-pkcs8": "^2.11.0",
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "@peculiar/asn1-x509-attr": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-rsa": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-rsa/-/asn1-rsa-2.11.0.tgz",
+      "integrity": "sha512-S2sBJmbfI09Kzdt9cEhE6pDNjHpVTkURs+811+PxS8AvsTLxC4woMNRhxHYaIbClkkNfAVt0tZxJdINVfUmzuA==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-schema": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-schema/-/asn1-schema-2.11.0.tgz",
+      "integrity": "sha512-8xh4avo53/vXO6UEv9yaoJ83hY581geaLTygf61NPIXP5AeIZCPjJhpTaYU23IZkG+NpLN/C9FYzWp7hphIT9A==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-x509": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509/-/asn1-x509-2.11.0.tgz",
+      "integrity": "sha512-J1sHAwGNlk+8J+FeR1eLVc6Gq0T9f9ITc3HWyPYgJraoW6U8AJuQiWVJ3SCEpltfTdpOY7fHdHT5oKAsbK/jww==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-x509-attr": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509-attr/-/asn1-x509-attr-2.11.0.tgz",
+      "integrity": "sha512-Fgvnd9REmLxEj/4cbDP54dNUNUXkzUksXLqEHqs1mHBuSRjSTCUSPM/WQIZYSvrdG7ND9CX1AQtPoIBekhgQSA==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/utils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@peculiar/utils/-/utils-2.0.3.tgz",
+      "integrity": "sha512-+oL3HPFRIZ1St2K50lWCXiioIgSoxzz7R1J3uF6neO2yl1sgmpgY6XXJH4BdpoDkMWznQTeYF6oWNDZLCdQ4eQ==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/x509": {
+      "version": "1.14.3",
+      "resolved": "https://registry.npmjs.org/@peculiar/x509/-/x509-1.14.3.tgz",
+      "integrity": "sha512-C2Xj8FZ0uHWeCXXqX5B4/gVFQmtSkiuOolzAgutjTfseNOHT3pUjljDZsTSxXFGgio54bCzVFqmEOUrIVk8RDA==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-cms": "^2.6.0",
+        "@peculiar/asn1-csr": "^2.6.0",
+        "@peculiar/asn1-ecc": "^2.6.0",
+        "@peculiar/asn1-pkcs9": "^2.6.0",
+        "@peculiar/asn1-rsa": "^2.6.0",
+        "@peculiar/asn1-schema": "^2.6.0",
+        "@peculiar/asn1-x509": "^2.6.0",
+        "pvtsutils": "^1.3.6",
+        "reflect-metadata": "^0.2.2",
+        "tslib": "^2.8.1",
+        "tsyringe": "^4.10.0"
+      },
+      "engines": {
+        "node": ">=20.0.0"
       }
     },
     "node_modules/@pinojs/redact": {
@@ -19,6 +235,31 @@
       "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
       "license": "MIT"
     },
+    "node_modules/@simplewebauthn/browser": {
+      "version": "13.3.0",
+      "resolved": "https://registry.npmjs.org/@simplewebauthn/browser/-/browser-13.3.0.tgz",
+      "integrity": "sha512-BE/UWv6FOToAdVk0EokzkqQQDOWtNydYlY6+OrmiZ5SCNmb41VehttboTetUM3T/fr6EAFYVXjz4My2wg230rQ==",
+      "license": "MIT"
+    },
+    "node_modules/@simplewebauthn/server": {
+      "version": "13.3.3",
+      "resolved": "https://registry.npmjs.org/@simplewebauthn/server/-/server-13.3.3.tgz",
+      "integrity": "sha512-LelX/lcy5cjc15A86i/aNxHhB5eU7dd20QsbP0VLAf9e38+SLlsnqCCyecx3xqfGofhmX05h1J9fKRYWxw+luA==",
+      "license": "MIT",
+      "dependencies": {
+        "@hexagon/base64": "^1.1.27",
+        "@levischuck/tiny-cbor": "^0.2.2",
+        "@peculiar/asn1-android": "^2.6.0",
+        "@peculiar/asn1-ecc": "^2.6.1",
+        "@peculiar/asn1-rsa": "^2.6.1",
+        "@peculiar/asn1-schema": "^2.6.0",
+        "@peculiar/asn1-x509": "^2.6.1",
+        "@peculiar/x509": "^1.14.3"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
     "node_modules/accepts": {
       "version": "1.3.8",
       "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
@@ -38,6 +279,20 @@
       "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
       "license": "MIT"
     },
+    "node_modules/asn1js": {
+      "version": "3.0.10",
+      "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-3.0.10.tgz",
+      "integrity": "sha512-S2s3aOytiKdFRdulw2qPE51MzjzVOisppcVv7jVFR+Kw0kxwvFrDcYA0h7Ndqbmj0HkMIXYWaoj7fli8kgx1eg==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "pvtsutils": "^1.3.6",
+        "pvutils": "^1.1.5",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/atomic-sleep": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
@@ -804,6 +1059,24 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/pvtsutils": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/pvtsutils/-/pvtsutils-1.3.6.tgz",
+      "integrity": "sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/pvutils": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/pvutils/-/pvutils-1.2.0.tgz",
+      "integrity": "sha512-BbubeCEyTuQjVMakvJQ/Sxbc93F2pwmbsxONT/ZRrwU7Ua38d8unYTwXpTVLAKJ4BDuH9IGztCjQcd/N/39Dvg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
     "node_modules/qs": {
       "version": "6.15.2",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
@@ -858,6 +1131,12 @@
         "node": ">= 12.13.0"
       }
     },
+    "node_modules/reflect-metadata": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/reflect-metadata/-/reflect-metadata-0.2.2.tgz",
+      "integrity": "sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==",
+      "license": "Apache-2.0"
+    },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
@@ -1061,6 +1340,30 @@
         "node": ">=0.6"
       }
     },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/tsyringe": {
+      "version": "4.10.0",
+      "resolved": "https://registry.npmjs.org/tsyringe/-/tsyringe-4.10.0.tgz",
+      "integrity": "sha512-axr3IdNuVIxnaK5XGEUFTu3YmAQ6lllgrvqfEoR16g/HGnYY/6We4oWENtAnzK6/LpJ2ur9PAb80RBt7/U4ugw==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^1.9.3"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/tsyringe/node_modules/tslib": {
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
+      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
+      "license": "0BSD"
+    },
     "node_modules/type-is": {
       "version": "1.6.18",
       "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.13",
+  "version": "1.25.14",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",
@@ -25,7 +25,9 @@
   "dependencies": {
     "express": "^4.21.2",
     "pg": "^8.20.0",
-    "pino": "^9.14.0"
+    "pino": "^9.14.0",
+    "@simplewebauthn/browser": "^13.3.0",
+    "@simplewebauthn/server": "^13.3.3"
   },
   "overrides": {
     "undici": "^6.29.1"

package/release-notes.json

@@ -11788,5 +11788,23 @@
       "id": "1005273",
       "text": "The project guide now ends with a written plan (with recommended features drawn only from what Bongos really offers), saves the chat so visitors can come back to it, moves it onto their account when they sign up, and deletes i"
     }
+  ],
+  "1.25.14": [
+    {
+      "id": "1004753",
+      "text": "Designed how a project owner can give a teammate access to help run their hosted project, without letting anyone who merely signs in act on it."
+    },
+    {
+      "id": "1005109",
+      "text": "Founders setting up a new project can now copy each setup task's prompt straight from the Genesis page, without opening the task."
+    },
+    {
+      "id": "1005269",
+      "text": "Adding a security card works again on sites that install Bongos as a package: the card libraries are now included in the released core."
+    },
+    {
+      "id": "1005279",
+      "text": "The project guide now asks whether you are starting fresh or already have something, and for an existing project plans from your own description, without ever reading your files or code."
+    }
   ]
 }

package/scripts/bongos/package-core.js

@@ -288,7 +288,9 @@ function isNpmStripped(pathRel) {
 // published core without it crashes MODULE_NOT_FOUND at startup (task 1003160).
 // discord.js (+ its undici requirement) is an OPTIONAL MODULE dependency, not
 // core; a consumer that enables the discord module installs it itself.
-const CORE_DEP_NAMES = ['express', 'pg', 'pino'];
+// The security-card libraries joined in task 1005269: routes/my-passkeys.js serves the browser bundle
+// and requires the server lib, and a package without them answers bundle_missing on every instance.
+const CORE_DEP_NAMES = ['express', 'pg', 'pino', '@simplewebauthn/browser', '@simplewebauthn/server'];
 
 // Pure — takes the source package.json's `dependencies`/`overrides` as plain
 // objects so this is unit-testable with no disk I/O. Throws if a required core
@@ -928,7 +930,7 @@ function main() {
   const sourcePkgLock = JSON.parse(pkgLockRaw.toString('utf8'));
   const corePkgJson = buildPackageJson({ version, sourceDeps: sourcePkgJson.dependencies, sourceOverrides: sourcePkgJson.overrides });
   const corePkgLock = prunePackageLock(sourcePkgLock, {
-    name: corePkgJson.name, version, rootRanges: { express: corePkgJson.dependencies.express, pg: corePkgJson.dependencies.pg },
+    name: corePkgJson.name, version, rootRanges: { ...corePkgJson.dependencies },
   });
   console.error(`[package-core] synthesized package.json (${Object.keys(corePkgJson.dependencies).join(', ')}) + pruned package-lock.json (${Object.keys(corePkgLock.packages).length - 1} of ${Object.keys(sourcePkgLock.packages).length - 1} locked packages kept).`);
 

package/src/bongos/module-scope-map.js

@@ -191,6 +191,7 @@ const MODULE_GLOBS = {
   'front-door-guide': [
     'modules/front-door-guide/', 'tests/front_door_guide.mjs',
     'tests/front_door_guide_plan.mjs', 'tests/front_door_guide_db.mjs',
+    'tests/front_door_guide_existing.mjs',
   ],
   // The /raise investor page (task 1004847, ADR 0384): hub-only.
   raise: [

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.25.13'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.14'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/cutover_codemod.mjs

@@ -183,7 +183,7 @@ t('planCodemod rewrites host files, skips core files, reports unmapped', () => {
 
 t('every CORE_INTERNAL_MAP target is exported by the core package (a rewrite never outruns an export)', () => {
   const { buildPackageJson } = require('../scripts/bongos/package-core.js');
-  const pkg = buildPackageJson({ version: '0.0.0-test', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
+  const pkg = buildPackageJson({ version: '0.0.0-test', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0', '@simplewebauthn/browser': '^13.0.0', '@simplewebauthn/server': '^13.0.0' } });
   for (const mapped of Object.values(CORE_INTERNAL_MAP)) {
     assert.ok(pkg.exports[`./${mapped}`], `@bongos/core must export ./${mapped} (targeted by the codemod)`);
   }

package/tests/front_door_guide_db.mjs

@@ -25,6 +25,7 @@ const db = require('../modules/front-door-guide/db.js');
 const sql = (n) => readFileSync(new URL(`../modules/front-door-guide/migrations/${n}`, import.meta.url), 'utf8');
 const M1 = sql('front_door_guide_001_conversations.sql');
 const M2 = sql('front_door_guide_002_plan_and_account.sql');
+const M3 = sql('front_door_guide_003_starting_point.sql');
 
 const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
 try {
@@ -48,7 +49,7 @@ async function cleanup() {
 const call = (over = {}) => ({ visitorHash: V, model: 'claude-opus-5-5', inputTokens: 800, outputTokens: 200, cacheReadTokens: 0, cacheWriteTokens: 0, costMicro: 9000, stopReason: 'end_turn', ...over });
 
 try {
-  for (const m of [M1, M2, M1, M2]) await x(m); // applies, then re-applies as a no-op
+  for (const m of [M1, M2, M3, M1, M2, M3]) await x(m); // applies, then re-applies as a no-op
   await cleanup();
   await insertTestBuilders(pool, [{ id: ALICE, login: 't1005273-alice' }, { id: BOB, login: 't1005273-bob' }]);
 
@@ -99,6 +100,10 @@ try {
   assert.equal(await db.siteSpendMicro('day', x), before, 'the budgets still count the deleted chat\'s money');
   assert.ok(before >= dayBefore + 9000 + 20000 + 1 + 5 + 7000);
 
+  // The starting point (task 1005279): set, read back, and nothing else accepted.
+  assert.equal((await db.setStartingPoint(conv.id, 'existing', x)).starting_point, 'existing');
+  await assert.rejects(x(`UPDATE front_door_guide_conversations SET starting_point = 'repo' WHERE id = $1`, [conv.id]));
+
   // Refusals the schema owns.
   await assert.rejects(x(`INSERT INTO front_door_guide_calls (visitor_hash, model, cost_micro, kind) VALUES ($1, 'm', 1, 'other')`, [V]));
   await assert.rejects(x(`INSERT INTO front_door_guide_calls (visitor_hash, model, cost_micro) VALUES ($1, 'm', -1)`, [V]));